Matthew Garrett Turned On Google Cast in His US Samsung Q800A Soundbar by Rooting It and Telling It It Was Australian

Garrett’s setup was a Chromecast Audio plugged into the soundbar over optical. The trouble was his TV, a Samsung Frame, which “infuriatingly generates an eARC signal even if it’s only in art mode and isn’t going to make any noise.” The soundbar treats optical and eARC as one “Digital In,” so the TV kept stealing the input. “This switches the soundbar away from optical and I get sad.”

Then he learned the Australian model has Cast built in. He downloaded both firmware images from Samsung support. Both were encrypted, and “the encrypted blob was identical.”

So he bought a broken Q800A on eBay, pulled the eMMC storage chip off the board with hot air and read it on his own machine. That needed a custom kernel, because “Samsung uses a weird in-house filesystem called VDFS4 on some of their devices.”

Inside was sdbd, the daemon for Samsung’s take on the Android Debug Bridge. It starts when a network device named “huart0” shows up, and Samsung’s own GPL source showed when that happens: an Ethernet adapter on the asix or ax88179_178a drivers, plus a config file that isn’t set to “0.”

Flipping that file took the Samsung multiroom protocol, which a community project had already written up on GitHub. Two HTTP requests to port 55001 or 56001, the second one a SetUartOnOff command, then an ASIX-chipset Ethernet adapter in the soundbar’s micro-B USB port. The soundbar appeared at 192.168.250.250. sdb root on, then sdb shell, and he had root.

The Cast app on the soundbar asks Samsung at startup whether Cast is allowed. Its request carried the country code, “US.” Garrett replayed it with curl as “AU” and got a yes. One command made the soundbar Australian:

buxton2ctl set-string system db/comss/countrycode AU

Two more snags. The app couldn’t provision its Cast key, because of a permissions problem; running it by hand as root fixed that. And it still didn’t advertise itself, because the device’s tos_accepted flag was false. Samsung’s app normally sets that during setup, and it had skipped setup on a soundbar it thought couldn’t do Cast. POSTing {"tos_accepted": true} to the setup endpoint finished the job.

Then the bill came due. “Unfortunately the device vanished from my Smartthings home aferwards,” Garrett wrote, likely because the soundbar’s country no longer matched his account. The app re-checks with Samsung “every 24 hours, ugh,” and the box runs only signed binaries. Though, as he points out, one of those signed binaries is a full Python interpreter.

Garrett’s trick works on one soundbar model and needed a desoldered chip to figure out. Very few owners will repeat it. The interesting part is what it shows about the soundbar in your living room: a feature can sit fully installed on a box you own, waiting on a yes from a server that asks where you live. The open question is whether the signed Python interpreter he spotted is the next way in.